Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
cups + krb: it falls down into basic authorization instead of negotiate
There is error: 'Authorized using Basic, expected Negotiate!'
Version-Release number of selected component (if applicable):
# rpm -q cups
cups-1.5.3-1.1.el7.x86_64
# rpm -qa | grep krb
krb5-appl-clients-1.0.2-4.el7.x86_64
krb5-appl-servers-1.0.2-4.el7.x86_64
krb5-debuginfo-1.10-6.el7.x86_64
krb5-appl-debuginfo-1.0.2-4.el7.x86_64
krb5-pkinit-1.10-6.el7.x86_64
krb5-libs-1.10-6.el7.x86_64
krb5-server-1.10-6.el7.x86_64
krb5-auth-dialog-3.2.1-3.el7.x86_64
krb5-workstation-1.10-6.el7.x86_64
krb5-devel-1.10-6.el7.x86_64
krb5-server-ldap-1.10-6.el7.x86_64
pam_krb5-2.3.13-2.el7.x86_64
krb5-auth-dialog-debuginfo-3.2.1-3.el7.x86_64
How reproducible:
deterministic
Steps to Reproduce:
1. set up cups + krb5, DefaultAuthType=Negotiate
2. user has valid ticket
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: KerberesiedPetr
Valid starting Expires Service principal
07/04/12 10:57:43 07/05/12 10:57:43 krbtgt/EXAMPLE.COM
renew until 07/04/12 10:57:43
3. user is in the root group,
# id KerberesiedPetr
uid=1001(KerberesiedPetr) gid=1001(KerberesiedPetr) groups=1001(KerberesiedPetr),0(root)
4. lpadmin -p $TPRN1 -v file:/dev/null -E -m $ML
Actual results:
lpadmin expect password for root on localhost?
cups/error_log:
D [04/Jul/2012:10:48:10 -0400] cupsdReadClient: 19 1.1 CUPS-Add-Modify-Printer 1
D [04/Jul/2012:10:48:10 -0400] CUPS-Add-Modify-Printer ipp://localhost:631/printers/testprinter1
D [04/Jul/2012:10:48:10 -0400] cupsdIsAuthorized: username="root"
E [04/Jul/2012:10:48:10 -0400] Authorized using Basic, expected Negotiate!
D [04/Jul/2012:10:48:10 -0400] Returning HTTP Unauthorized for CUPS-Add-Modify-Printer (ipp://localhost:631/printers/testprinter1) from localhost
Expected results:
no password is expected
Additional info:
rhel6 works well with exactly same settings
This seems to be due to a check in the server end about whether this is a local connection:
scheduler/client.c:2719 (cupsdSendHeader):
#ifdef HAVE_GSSAPI
else if (auth_type == CUPSD_AUTH_NEGOTIATE)
{
# ifdef AF_LOCAL
if (_httpAddrFamily(con->http.hostaddr) == AF_LOCAL)
strlcpy(auth_str, "Basic realm=\"CUPS\"", sizeof(auth_str));
else
# endif /* AF_LOCAL */
strlcpy(auth_str, "Negotiate", sizeof(auth_str));
}
#endif /* HAVE_GSSAPI */
Adjusting the lpadmin command to add "-h $IP_ADDR" with the external IP address of the machine allows it to succeed.
This seems to have been added as part of upstream revision 9732 on trunk:
commit 8e48ce8bd6acc030f9e913cd80ed31e7465d7ef1
Author: mike <mike@7a7537e8-13f0-0310-91df-b6672ffda945>
Date: Sun May 1 19:55:04 2011 +0000
Use GSS framework, when available, and support acquisition of Kerberos creds
when the underlying libraries support it (may add others as time permits).
git-svn-id: http://svn.easysw.com/public/cups/trunk@9732 7a7537e8-13f0-0310-91df-b6672ffda945
This request was resolved in Red Hat Enterprise Linux 7.0.
Contact your manager or support representative in case you have further questions about the request.